Privacy Policy

We collect what the Platform needs to work, we do not sell it, we do not run advertising or tracking, and you can export or delete your account yourself from Settings → Account.

The warning is the part people miss. The Fridge is a public social product built on a public blockchain. Your profile, your handle, your notes and your reactions are visible to anyone. Anything written to Ethereum (trades, transfers, token ownership) is permanent and outside our control. We can delete our copy of your data. Nobody can delete the chain. Please decide what to publish with that in mind.

The Fridge is currently an invite-only closed alpha. This Policy describes the product as it actually behaves today, not as we intend it to behave later.

The Fridge operates the Platform at www.thefridge.io and is the data controller for the personal data described here. You can reach us at any time at hi@thefridge.io.

We are a small team and we do not currently have an appointed representative in the EU or UK. If you are in the EU, the UK, or a US state with its own privacy law, the rights in Section 6 apply to you regardless, and the contact address above is the way to use them.

Everything below is data we actually store. Where something is kept only for a short time, or kept in a place that outlives your account, we say so.

• Wallet addresses: the Ethereum address you sign in with, plus any additional wallets you link. Used as your identifier, for NFT lookups, and for on-chain features. We also keep a record of wallets you have linked and unlinked, so that ownership claims can be checked.
• Email address: collected by Privy if you sign in with email, and separately if you join the waitlist. Never shown publicly and never shown to other users.
• Privy DID: a cross-device identity token from Privy that links your account across devices. Never exposed publicly.
• IP address: used transiently for rate limiting, which is not stored. It is stored in two specific places: on the audit record written when an invite link is used, and on bug reports and survey answers you submit. Both are covered by the deletion rules in Section 5.
• Browser user-agent: stored only on the invite-redemption audit record described above, to detect invite abuse.
• Content you create: notes, replies, reactions, follows, profile information (handle, display name, bio, avatar, banner, status, social links), shelves and pins. This is the core data of the Platform.
• Spot membership: the Spots you join, your role in them, join requests you send, and moderation actions taken in Spots you moderate.
• Marketplace activity: listings you create on On The Counter, including your wallet address and the signed order, and NFTs you add to your watchlist.
• Activity Ledger events: a timeline of actions such as trades, watchlist moves and magnet unlocks.
• Calendar events: entries you add to your Personal Calendar. These are private to you until you add the Calendar shelf to your profile. Once you do, you are publishing them: the title, description and date of each entry become visible to anyone who can see your profile, including people who are not signed in. Remove the shelf and they stop being served.
• Push notification tokens: stored if you opt in to push notifications. Used solely to send you notifications you have enabled.
• Terms acceptance: the date and version of the Terms you accepted when you created your account. Kept as proof of consent.
• Waitlist entry: if you joined the waitlist: your handle, email, optional wallet address, whether you confirmed the email, and whether you agreed to receive waitlist email. This is a separate list from your account: see Section 5. If you reserved your handle on a Preview Fridge, we also record which one and when, and if you then create an account, that Preview Fridge is recorded on it too, so we can tell which pages bring people in.
• Preview Fridges: an example Fridge we build for a collector from pieces they have posted publicly on X, shared in a post that tags them. It holds their X username and those pieces, and nothing else about them: no wallet, no email, no other account details. It says on the page and on its share card that it is not their account. It comes down on a set date, and anyone can ask us to take one down sooner from the page itself. We count how many times each one is opened, and how many of those visits came from X, without recording anything about the visitor.
• Bug reports and survey answers: anything you submit through the feedback button, including the text you write, the page you were on, and your IP address.
• Moderation reports: reports you file, and reports filed about you. Where a report is about a specific note, a copy of that note is kept with the report as evidence. See Section 5, which explains why this outlives deletion.
• ENS name: if your wallet has one, we read it from the blockchain and cache it so your profile can display it.
• Crash and error diagnostics: when something breaks, an error report is sent to our monitoring provider: what failed, where in the code, which page you were on, and your browser and version. If the error happened in your browser, a masked replay of the moments before it is sent too. See Section 4 for exactly what that replay does and does not contain.

We do not collect your name, date of birth, postal address, phone number, government ID, or payment card details. We never ask for your seed phrase or private key, and no part of The Fridge will ever ask you for one.

If you are in the EU or UK, the GDPR requires us to name a lawful basis for each purpose. These are ours:

• To provide the Platform: authenticating you, keeping you signed in, showing your profile and content, verifying NFT ownership to grant tier access, and running the marketplace. Basis: performance of a contract with you.
• To keep the Platform working and safe: rate limiting, detecting invite abuse, moderation, investigating reports, and diagnosing crashes and errors.Basis: our legitimate interest in a service that works and is not overrun by abuse, balanced against your interest in not being over-monitored, which is why error reports carry no identifying data, why session replays are masked, and why none of it is used to build a picture of you.
• To send you notifications you turned on, and waitlist or product email you ticked the box for. Basis: your consent, which you can withdraw at any time without affecting anything you did before.
• To measure how the site performs: anonymous, cookieless analytics. Basis: your consent. Nothing loads until you opt in.
• To meet legal obligations: keeping records of consent, and responding to lawful requests. Basis: legal obligation.

We do not use your data for advertising, profiling, or sale. We do not build advertising audiences, and we do not share personal information for cross-context behavioural advertising as those terms are defined under California law.

No automated decision-making. Nothing on The Fridge makes a decision about you by algorithm alone that produces a legal or similarly significant effect. Moderation decisions are made by people.

Running the Platform requires us to share data with infrastructure providers:

• Privy: handles authentication. Privy stores your email address, wallet address, and DID. Their Privacy Policy applies.
• Alchemy: used for NFT lookups and on-chain data. Your wallet address is sent to Alchemy when your NFT collection or tier is fetched. Their Privacy Policy applies.
• OpenSea: used to execute marketplace orders. When you list or buy, your wallet address and the signed order are sent to OpenSea. Their Privacy Policy applies.
• Neon: our PostgreSQL database provider. All Platform data is stored on Neon-hosted infrastructure. Neon's Privacy Policy applies.
• Vercel: hosts the Platform. Vercel receives all HTTP requests and logs associated metadata (IP, headers, request paths). Their Privacy Policy applies.
• Upstash: used for rate limiting (Redis). Temporarily stores IP-based counters with short expiry. No profile data is stored there.
• Sentry: error and performance monitoring. When something breaks, Sentry receives the error, the code path that produced it, the page URL, and your browser type. It also receives a sample of performance timings (roughly one request in ten). We have configured it not to attach identifying information (no IP address, no cookies, no request bodies, no account record), and we strip our own API credentials out of every report before it leaves.
  Session replay, stated plainly, because it is the part worth knowing about: if an error happens in your browser, Sentry records a replay of the moments leading up to it. We do not record normal sessions, only ones that hit an error. The replay is fully masked: the text on the page, everything you typed, and all images and video are blanked out before anything is sent, so their contents never leave your browser. What it does contain is the shape of the page, where you clicked, and which pages you moved between, and a page URL can include a handle. Their Privacy Policy applies.
• Resend: delivers our email (waitlist confirmation, invites, and alerts). Resend receives your email address and the contents of those messages. Their Privacy Policy applies.
• Your browser's push service: if you enable push notifications, delivery runs through the push service operated by your browser vendor (for example Google, Apple or Mozilla). We do not choose it and cannot see inside it.
• Vercel Analytics and Speed Insights: page-performance measurement. Cookieless, and only loaded if you opt in. See Section 7.

We do not sell your data, and we do not use advertising networks. We may disclose data where we are legally required to, or where it is necessary to investigate abuse or protect someone's safety.

International transfers.These providers are based in the United States and our infrastructure is hosted there. If you use The Fridge from the EU, the UK, or elsewhere, your data is transferred to and processed in the United States. That transfer relies on the providers' own transfer safeguards, typically the European Commission's Standard Contractual Clauses, described in the policies linked above.

You can delete your account yourself from Settings → Account. We would rather set out precisely what that does than tell you it erases everything, because it does not.

Deleted immediately and permanently:

• Your profile, notes, replies, reactions, follows, notifications, watchlist, pinned collections, calendar events, Spot memberships, Activity Ledger history, linked wallets, marketplace listings, and push subscriptions.
• Your identity with Privy is deleted too, on a best-effort basis, so your wallet is free to be used with a new account.
• Personal details on the invite record that let you in. Email, Privy DID, IP address and user-agent are erased, while an anonymous row is kept so invite counts stay correct.
• Your identity on any bug report or survey answer. The wallet address, handle and IP address are erased. The report text itself is kept, with nobody attached to it, so the bug can still be fixed.

Survives your deletion, deliberately:

• Moderation evidence. If one of your notes was named in a report, a copy of that note and the handle it was posted under is kept with the report. This exists so somebody cannot post abuse and erase the evidence by closing their account. It is not visible to other users.
• Spot moderation records: if you moderated a Spot, the record of actions taken stays so the members of that Spot can see what happened.
• Your waitlist entry, if you joined the waitlist, because it is a separate list. Every waitlist email carries an unsubscribe link, and you can email us to have the entry removed entirely.
• Everything on the blockchain. Your NFTs, transfers and trade history live on Ethereum. We cannot remove them and neither can anyone else.

One case where we will refuse to delete right away. If you are the owner of a Spot that still has active members, the deletion is blocked and we tell you so. Erasing the account would leave a live Spot with no owner and nobody able to moderate it. Transfer ownership or remove the Spot first, and the deletion goes through.

Everything else:

• Session cookie: expires automatically after 7 days. Signing out destroys it immediately.
• Rate limit counters: held in Redis in short windows, typically one hour, and deleted automatically.
• Push subscriptions: kept until you delete your account or revoke notification permission in your browser.
• Account data: kept for as long as your account exists. We do not keep a shadow copy of a deleted account.

Wherever you are, you have all of the rights below. We do not charge for any of them, and we will never treat you differently for using one.

• Access: see what we hold. Most of it is available instantly: Settings → Account → Export your data downloads a JSON file containing your profile, notes, reactions, follows, watchlist, notifications, notification settings, and the devices subscribed to push. Categories in Section 2 that are not yet in that file (for example Spot membership, marketplace listings and Ledger history) are available if you email us, and we will respond within 30 days.
• Portability: the same export is machine-readable JSON, yours to take anywhere.
• Correction: edit your profile at any time in Settings. If something we hold is wrong and you cannot reach it yourself, tell us and we will fix it.
• Deletion: Settings → Account. Section 5 sets out exactly what goes and what stays.
• Withdraw consent: turn off notifications in Settings, change your analytics choice in Section 7 below, or use the unsubscribe link in any waitlist email. Withdrawing is as easy as giving, and it never affects anything that happened before you withdrew.
• Object, and restrict processing: you can object to our processing data on the legitimate-interest basis in Section 3, or ask us to freeze processing while a dispute is resolved. Email us and we will action it, or explain why we cannot.
• Complain: if you are in the EU or UK you may lodge a complaint with your local data protection authority, and you do not have to raise it with us first.

If you are in California (or another US state with comparable law): you have the right to know what we collect and why, to delete it, to correct it, and to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of, but we honour the Global Privacy Control signal anyway, and your browser sending it will switch analytics off without you doing anything. You may use an authorised agent to make a request on your behalf. We will not discriminate against you for exercising any of these rights.

If there is ever a data breach affecting your personal data in a way likely to create a real risk to you, we will notify the relevant supervisory authority and tell you directly, without waiting to be asked.

We use three cookies. None of them tracks you between sites and none is used for advertising:

• fridge-session: an encrypted, httpOnly session cookie set after you sign in. Holds your session identity in sealed form. Expires after 7 days. Required for the Platform to function.
• fridge_access: set when you use an invite link, so the closed alpha knows your browser is allowed in. Expires after 7 days. Also cleared when you sign out or delete your account.
• fridge-home-tab remembers which tab of your home feed you were last reading, so a return visit puts you back on it instead of resetting you. It stores one word, lasts a year, and identifies nothing about you.

We also store a small amount of data in your browser's local storage: your analytics choice below, and whatever Privy needs to keep you signed in. That storage stays on your device.

We use no tracking cookies, no advertising cookies, and no third-party tracking cookies. Our analytics (Vercel Analytics and Speed Insights) are cookieless and do not follow you between sites, and they do not load at all until you say yes. If your browser sends a Global Privacy Control signal, we treat that as a no and do not ask again.

We take the following measures to protect your data:

• Server-side JWT verification: all authentication uses Privy's cryptographically verified access tokens. We never trust client-supplied identity data.
• Encrypted session cookies: sessions are sealed using iron-session with AES-256 encryption. Session secrets are stored as environment variables, never in code.
• HTTPS only: all traffic is encrypted in transit via TLS.
• Rate limiting: applied across the API, and on every endpoint that writes data, reaches a third-party provider, or could be used to enumerate accounts.
• Wallet addresses: never returned in public-facing search results, and never attached to a profile view by someone who is not signed in.

No security system is perfect, and we will not pretend otherwise. You are responsible for the security of your wallet and seed phrase. We cannot recover lost wallet access, and no support request will ever change that.

The Fridge is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected data from a minor, we will delete it promptly. If you believe a minor has created an account, please contact us and we will act on it.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If a change materially affects how we use data you have already given us, we will tell you through the Platform or by email before it takes effect, rather than relying on you to re-read this page.

Continued use of the Platform after a change takes effect means you accept the updated Policy. If you do not, you can export and delete your account at any time.

For privacy requests, data access, or questions about this Policy, contact us at:

• Email: hi@thefridge.io
• X (Twitter): @TheFridgeIo

We aim to answer privacy requests within 30 days. If a request is complex and needs longer, we will tell you why inside those 30 days rather than going quiet.

See also our Terms of Service and Risk Disclosure.